﻿// MSGinject.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>
#include<cstdio>
#include<windows.h>
#include  <direct.h>  
#include  <stdio.h>
#include<detours.h>
#pragma comment(lib, "detours.lib")

int main()
{
    STARTUPINFO si;
    PROCESS_INFORMATION pi;
    ZeroMemory(&si, sizeof(STARTUPINFO));
    ZeroMemory(&pi, sizeof(PROCESS_INFORMATION));
    si.cb = sizeof(STARTUPINFO);
    WCHAR DirPath[MAX_PATH + 1];
    wcscpy_s(DirPath, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\Dll1\\x64\\Debug");
    char DLLPath[MAX_PATH + 1] = "E:\\detours\\tmp1\\hust-detours\\Dll1\\x64\\Debug\\Dll1.dll";
    WCHAR EXE[MAX_PATH + 1] = { 0 };
    //wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\hust-detours\\TestMsgAndReg\\bin\\Release\\net6.0-windows\\WpfApp1.exe");
    //wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestHeap\\x64\\Debug\\dui2.exe");
    while (1) {

        printf("**********************************************\n");
        printf("恶意行为检测系统已启动\n");
        printf("下面提供测试样本，请选择需要被检测的文件\n");
        printf("1.messageboxAPI                 2.堆操作\n");
        printf("3.注册表操作                    4.文件操作\n");
        printf("5.内存操作\n");
        printf("0.退出恶意行为检测系统\n");
        printf("**********************************************\n");

        char a;
        a = getchar();
        if (a == '\n') {
            a = getchar();
        }
        if (a == '0') {
            printf("恶意行为检测系统退出，谢谢您的使用\n");
            break;
        }
        switch (a) {
        case '1':
            wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestMsgAndReg\\bin\\Release\\net6.0-windows\\WpfApp1.exe");
            printf("测试程序行为信息已输出到调试台，请在debugview中进行查看\n");
            break;
        case '2':
            wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestHeap\\x64\\Debug\\dui2.exe");
            break;
        case '3':
            wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestMsgAndReg\\bin\\Release\\net6.0-windows\\WpfApp1.exe");
            printf("测试程序行为信息已输出到调试台，请在debugview中进行查看\n");
            break;
        case '4':
            wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestFile\\x64\\Debug\\filet.exe");
            break;
        case '5':
            wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestMemcpy\\x64\\Debug\\TestMemcpy.exe");
            break;
        }

        if (DetourCreateProcessWithDllEx(EXE, NULL, NULL, NULL, TRUE, CREATE_DEFAULT_ERROR_MODE | CREATE_SUSPENDED, NULL, DirPath, &si, &pi, DLLPath, NULL))
        {

            ResumeThread(pi.hThread);
            WaitForSingleObject(pi.hProcess, INFINITE);
        }
        else
        {
            char error[100];
            sprintf_s(error, "%d", GetLastError());
        }

    }

    //wcscpy_s(EXE, MAX_PATH, L"E:\\detours\\tmp1\\hust-detours\\TestMemcpy\\x64\\Debug\\TestMemcpy.exe");

    return 0;
}

